2023 1Password — Okta support breach, session compromise

2023 Unknown records affected

Data compromised

None; no user data; admin reconnaissance only

Technical writeup

Threat actor used stolen session cookie from HAR file uploaded to Okta support. Accessed 1Password Okta instance; attempted IdP update, admin report. No user data accessed; vaults encrypted. Sessions cleared, creds rotated.

Root cause

Third-party breach (Okta); HAR file credential exposure

References

https://blog.1password.com/okta-incident
https://www.bleepingcomputer.com/news/security/1password-discloses-security-incident-linked-to-okta-breach/